Two different checks, often confused
Vulnerability assessments and penetration tests are often mentioned together, as if they were the same thing sold under two names. They are not, and the difference matters when you decide what you really need.
A vulnerability assessment is a broad scan: automated tools analyse systems, applications and configurations and return a list of known vulnerabilities, each with its severity. It is wide but shallow: it tells you what could be exploited, not whether it actually is.
A penetration test is a simulated attack: a person, or a team, actively tries to break into the systems using the vulnerabilities found, chaining them together and looking for paths that an automated scanner cannot see. It is narrower but deeper: it checks what really happens if someone tries.
Side by side
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Goal | List known vulnerabilities | Check whether and how they can be exploited |
| Method | Automated scan | Simulated attack, led by a person |
| Coverage | Broad: all systems in scope | Targeted: the agreed targets |
| False positives | Frequent | Rare: every flaw is actively verified |
| Typical frequency | Regular, as often as monthly | Once or twice a year, or after major changes |
| Cost | Lower | Higher: it takes an expert's time |
When to use one and when the other
It is not a choice between the two: they are complementary tools, useful at different times.
- The vulnerability assessment is the recurring baseline: it works for a periodic check, for keeping track of an environment that changes over time (new servers, new applications, updates), and for getting a quick picture after a change.
- The penetration test is for when you need to know whether a risk is real: before launching an internet-facing application, after a major network overhaul, when a customer or an insurer requires it, or when the vulnerability assessment has flagged too much to tell on its own what really matters.
A typical combination for an SME with internet-facing systems: regular vulnerability assessments, plus an annual penetration test targeting the most critical or most exposed systems.
How to read a report
A good report is not a list of acronyms. What to look for:
- Severity, usually expressed as the standard CVSS score, from 0 to 10, with indicative bands from low to critical. It is there to set priorities, not to alarm you: a critical vulnerability on an isolated system may matter less than a medium one on an exposed, central system.
- How it was verified: for a penetration test, the actual steps taken to exploit it, not just a statement that it exists.
- Real impact on your business, not just a generic technical description of the flaw.
- A remediation plan, with priorities: what to fix now, what can wait, what is an acceptable risk for the time being.
A report with no priorities, with a hundred items all marked "important", does not help you decide: it only helps justify the invoice.
What to ask whoever does the testing
- The scope, agreed in writing: which systems, which addresses, what times, what is excluded. Testing outside the scope without agreement is a problem, not a bonus.
- The method: which standards they follow, for example OWASP for web applications, what is tested manually and what with automated tools.
- What happens if they find a critical flaw during the test: it must be reported immediately, not just in the final report weeks later.
- An understandable report, with priorities, not just raw scanner output with a different logo on it.
- Willingness to discuss the results after delivery, so that you really understand what to do, rather than just reading a document.
Quick checklist
- I know when the last vulnerability assessment of my systems was carried out;
- I know whether and when a penetration test was carried out, and on which systems;
- I have a report with remediation priorities, not just a list of vulnerabilities;
- the critical vulnerabilities reported have been fixed, not just noted;
- the scope of the last test was written down and agreed, not generic;
- I know whether a customer, an insurer or a regulation requires me to carry out these checks.
In short
A vulnerability assessment lists known vulnerabilities across a broad scope; a penetration test checks whether they can really be exploited, on specific targets. You need both, at different times, and they are only worth anything if the report leads to a prioritised remediation plan.